trace-claim.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://agentrust-io.com/schema/trace-v0.2.json",
  "$defs": {
    "canonicalizableValue": {
      "description": "Any JSON value section 3.2.2 can canonicalize without ambiguity. RFC 7517 lets a JWK carry members this schema does not name, those members are covered by the signature, and they therefore need the constraint the named fields carry: `number` is excluded, and an integer is held to the safe-integer domain. Recursive, because such a member may itself be an array or an object.",
      "anyOf": [
        {
          "type": [
            "string",
            "boolean",
            "null"
          ]
        },
        {
          "type": "integer",
          "minimum": -9007199254740991,
          "maximum": 9007199254740991
        },
        {
          "type": "array",
          "items": {
            "$ref": "#/$defs/canonicalizableValue"
          }
        },
        {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/$defs/canonicalizableValue"
          }
        }
      ]
    }
  },
  "title": "TRACE Trust Record",
  "description": "A TRACE v0.2 Trust Record: hardware-attested governance evidence for an AI agent execution.",
  "type": "object",
  "required": [
    "eat_profile",
    "iat",
    "subject",
    "model",
    "runtime",
    "policy",
    "data_class",
    "build_provenance",
    "appraisal",
    "cnf"
  ],
  "properties": {
    "eat_profile": {
      "type": "string",
      "const": "tag:agentrust-io.com,2026:trace-v0.2",
      "description": "EAT profile URI identifying this as a TRACE v0.2 Trust Record."
    },
    "iat": {
      "type": "integer",
      "description": "Issued-at time as Unix epoch seconds.",
      "minimum": 1700000000,
      "maximum": 9007199254740991
    },
    "subject": {
      "type": "string",
      "description": "Workload identity as a SPIFFE SVID URI or DID URI. A SPIFFE ID carries a trust domain and a workload path within it; a DID carries a lowercase method name, per DID Core section 3.1, and a method-specific identifier. A prefix alone is not an identity: spiffe://example.org names a trust domain and no workload.",
      "pattern": "^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$"
    },
    "model": {
      "type": "object",
      "description": "Model identity and provenance.",
      "required": [
        "provider",
        "model_id"
      ],
      "properties": {
        "provider": {
          "type": "string",
          "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')."
        },
        "model_id": {
          "type": "string",
          "description": "Model identifier as used by the provider."
        },
        "version": {
          "type": "string",
          "description": "Model version or snapshot identifier."
        },
        "weights_digest": {
          "type": "string",
          "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "aibom_uri": {
          "type": "string",
          "format": "uri",
          "description": "URI to SPDX 3.0 AI Profile or CycloneDX 1.7 ML-BOM for this model."
        }
      },
      "additionalProperties": false
    },
    "runtime": {
      "type": "object",
      "description": "TEE measurement chain binding the workload to hardware.",
      "required": [
        "platform",
        "measurement"
      ],
      "properties": {
        "platform": {
          "type": "string",
          "enum": [
            "intel-tdx",
            "amd-sev-snp",
            "azure-cvm-sev-snp",
            "nvidia-h100",
            "nvidia-blackwell",
            "aws-nitro",
            "arm-cca",
            "google-confidential-space",
            "tpm2",
            "software-only"
          ],
          "description": "Hardware platform providing the root of trust. software-only marks records with no hardware root of trust, for example a development-mode execution, or a record assembled from evidence produced outside the runtime (origin.kind other than self requires this value; see spec 3.1.1). Such records must never be treated as attested evidence."
        },
        "measurement": {
          "type": "string",
          "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "rim_uri": {
          "type": "string",
          "format": "uri",
          "description": "URI to the vendor-published Reference Integrity Manifest for this measurement."
        },
        "nonce": {
          "type": "string",
          "description": "Freshness nonce binding the attestation report to this record (base64url, no padding)."
        },
        "firmware_version": {
          "type": "string",
          "description": "Firmware or microcode version included in the measurement."
        }
      },
      "additionalProperties": false
    },
    "policy": {
      "type": "object",
      "description": "Policy bundle sealed to the TEE measurement.",
      "required": [
        "bundle_hash",
        "enforcement_mode"
      ],
      "properties": {
        "bundle_hash": {
          "type": "string",
          "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "enforcement_mode": {
          "type": "string",
          "enum": [
            "enforce",
            "advisory",
            "silent",
            "declared"
          ],
          "default": "enforce",
          "description": "How the policy named by bundle_hash related to this execution. enforce: evaluated and blocked on deny. advisory: evaluated, logged, allowed. silent: evaluated and enforced with operational logs suppressed; the audit chain still records every would-have-denied decision. declared: the policy is named and bound into the signed record and NOTHING evaluated it, which is the honest value for a producer with no policy engine, such as an agent framework. Gateways MUST default to enforce. A deployment MUST explicitly configure silent. declared is never a default, a producer that evaluates policy MUST NOT use it, and a consumer MUST NOT read it as evidence that any rule was checked."
        },
        "version": {
          "type": "string",
          "description": "Policy bundle version (semantic versioning recommended)."
        },
        "policy_uri": {
          "type": "string",
          "format": "uri",
          "description": "URI to the policy bundle for verification."
        }
      },
      "additionalProperties": false
    },
    "data_class": {
      "type": "string",
      "description": "Highest-sensitivity data classification of inputs and outputs processed during this execution.",
      "examples": [
        "public",
        "internal",
        "confidential",
        "restricted",
        "top-secret"
      ]
    },
    "tool_transcript": {
      "type": "object",
      "description": "Bound hash of the MCP/A2A tool-call transcript. OPTIONAL for Phase 1 records; REQUIRED for Phase 2+.",
      "required": [
        "hash"
      ],
      "properties": {
        "hash": {
          "type": "string",
          "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "call_count": {
          "type": "integer",
          "minimum": 0,
          "maximum": 9007199254740991,
          "description": "Total number of tool calls in this session."
        },
        "transcript_uri": {
          "type": "string",
          "format": "uri",
          "description": "URI to the full transcript on the transparency log."
        }
      },
      "additionalProperties": false
    },
    "delegation": {
      "type": "object",
      "description": "A2A profile: links this record to the delegating hop's Trust Record. Present when this execution acted on delegated authority; absent on a root (non-delegated) execution. A chain of these forms an offline-verifiable delegation DAG.",
      "required": [
        "parent_record_hash",
        "credential_id"
      ],
      "properties": {
        "parent_record_hash": {
          "type": "string",
          "description": "SHA-256 or SHA-384 digest of the parent hop's Trust Record.",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "credential_id": {
          "type": "string",
          "minLength": 1,
          "description": "Identifier of the delegation credential this hop acted under."
        }
      },
      "additionalProperties": false
    },
    "origin": {
      "type": "object",
      "description": "Where the evidence in this record came from, when that is not this runtime. Absent means the runtime produced its own record, which is what a consumer assumes and what every hardware profile is. Present means something else assembled the record from evidence it did not measure. A non-self kind cannot carry a hardware runtime.platform.",
      "required": [
        "kind",
        "producer"
      ],
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "self",
            "third-party-control-plane",
            "log-import"
          ],
          "description": "self: the runtime produced its own record. third-party-control-plane: assembled from another vendor's runtime governance output, asserted by the system that produced it with no root outside that system. log-import: assembled from a log or export whose producer is not a control plane."
        },
        "producer": {
          "type": "string",
          "minLength": 1,
          "description": "Identifier of the system that produced the source evidence."
        },
        "source_event_id": {
          "type": "string",
          "minLength": 1,
          "description": "Identifier of the source event in the producing system, so a record can be traced back to it."
        },
        "ingested_at": {
          "type": "integer",
          "minimum": 1700000000,
          "maximum": 9007199254740991,
          "description": "Unix time at which the source evidence was ingested. Distinct from iat, which is when this record was issued."
        }
      },
      "additionalProperties": false
    },
    "references": {
      "type": "array",
      "description": "Facts outside this record that it points at. Spec section 3.1.2. An entry is a pointer, not evidence: the signature attests that this record points there, not the truth of what it points at. The block is assurance-neutral and does not affect runtime.platform. Two further rules in 3.1.2 bind verifiers rather than records, so this schema cannot express them: a verifier MUST NOT reject a record because an entry cannot be resolved, and MUST NOT treat a resolved entry as attested evidence.",
      "items": {
        "type": "object",
        "required": [
          "rel",
          "id",
          "resolver"
        ],
        "properties": {
          "rel": {
            "type": "string",
            "minLength": 1,
            "description": "Relationship type. The registered values are a registry that grows, so this is not a closed set. authorized-intent: an authorization decided before execution, held in another system. approval-outcome: an attributable human approval attached to a step-up or defer decision. behavior-trace: a behavioural record of what the agent did, of which this record is the environment evidence."
          },
          "id": {
            "type": "string",
            "minLength": 1,
            "description": "Identifier of the referenced fact within the resolver's system."
          },
          "resolver": {
            "type": "string",
            "minLength": 1,
            "description": "Identifier of the party obliged to resolve id. A producer that cannot name one omits the entry. Which identifiers are self-asserted is not decidable from the record, so this constrains the field's presence and not its value."
          },
          "retention": {
            "type": "string",
            "pattern": "^P(\\d+W|(\\d+Y(\\d+M)?(\\d+D)?|\\d+M(\\d+D)?|\\d+D)(T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))?|T(\\d+H(\\d+M)?(\\d+S)?|\\d+M(\\d+S)?|\\d+S))$",
            "description": "Period for which resolver undertakes to keep id resolvable, as an ISO 8601 duration. An undertaking only: nothing in this specification enforces it."
          },
          "digest": {
            "type": "string",
            "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$",
            "description": "SHA-256 or SHA-384 digest of the referenced object, when the producer holds it at issue time."
          }
        },
        "additionalProperties": false
      }
    },
    "build_provenance": {
      "type": "object",
      "description": "SLSA provenance for the workload (agent code + container image).",
      "required": [
        "slsa_level",
        "digest"
      ],
      "properties": {
        "slsa_level": {
          "type": "integer",
          "minimum": 0,
          "maximum": 3,
          "description": "SLSA Build Level achieved. Level 0 = software-only (development/staging); Level 2 minimum for TRACE conformance; Level 3 for production mark."
        },
        "builder": {
          "type": "string",
          "description": "SLSA builder URI."
        },
        "digest": {
          "type": "string",
          "description": "SHA-256 or SHA-384 digest of the container image or workload binary.",
          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
        },
        "provenance_uri": {
          "type": "string",
          "format": "uri",
          "description": "URI to the SLSA provenance attestation on a Sigstore/Rekor or compatible log."
        },
        "provenance_depth": {
          "type": "string",
          "enum": [
            "surface",
            "builder",
            "transitive"
          ],
          "description": "Depth of supply-chain verification the issuer claims for this record. surface: digest matches the workload artifact and builder is in a trusted set. builder: all of surface, plus provenance_uri resolves, the SLSA attestation signature verifies, its subject matches digest, and its builder.id matches builder. transitive: all of builder, plus every entry in the SLSA materials / resolvedDependencies has a verifiable publisher attestation. Records omitting this field are treated as surface by verifiers, so existing records keep their meaning."
        }
      },
      "additionalProperties": false
    },
    "appraisal": {
      "type": "object",
      "description": "Verifier's EAR appraisal of the evidence (draft-ietf-rats-ar4si).",
      "required": [
        "status",
        "verifier"
      ],
      "properties": {
        "status": {
          "type": "string",
          "enum": [
            "affirming",
            "warning",
            "contraindicated",
            "none"
          ],
          "description": "EAR appraisal status."
        },
        "verifier": {
          "type": "string",
          "format": "uri",
          "description": "URI identifying the verifier that produced this appraisal."
        },
        "policy_ref": {
          "type": "string",
          "format": "uri",
          "description": "URI to the appraisal policy used."
        },
        "timestamp": {
          "type": "integer",
          "minimum": -9007199254740991,
          "maximum": 9007199254740991,
          "description": "Unix epoch seconds when the appraisal was produced."
        },
        "provenance_depth_verified": {
          "type": "string",
          "enum": [
            "surface",
            "builder",
            "transitive"
          ],
          "description": "Depth at which this verifier actually checked build_provenance, which is not necessarily the depth the issuer claimed. A verifier may downgrade when deeper evidence does not resolve, and records the lower depth rather than a failure of the higher one. A verifier does not record a depth higher than it executed."
        }
      },
      "additionalProperties": false
    },
    "transparency": {
      "type": "string",
      "format": "uri",
      "description": "SCITT receipt URI. The Trust Record is the Signed Statement; this URI resolves to the inclusion proof (Receipt) on the transparency log."
    },
    "cnf": {
      "type": "object",
      "description": "Confirmation key (RFC 8747) that binds the Trust Record to the TEE-held signing key.",
      "required": [
        "jwk"
      ],
      "properties": {
        "jwk": {
          "type": "object",
          "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y; RSA keys require n and e.",
          "required": [
            "kty"
          ],
          "properties": {
            "kty": {
              "type": "string"
            },
            "crv": {
              "type": "string"
            },
            "x": {
              "type": "string"
            },
            "y": {
              "type": "string"
            },
            "n": {
              "type": "string"
            },
            "e": {
              "type": "string"
            },
            "kid": {
              "type": "string"
            }
          },
          "allOf": [
            {
              "if": {
                "required": [
                  "kty"
                ],
                "properties": {
                  "kty": {
                    "const": "OKP"
                  }
                }
              },
              "then": {
                "required": [
                  "crv",
                  "x"
                ]
              }
            },
            {
              "if": {
                "required": [
                  "kty"
                ],
                "properties": {
                  "kty": {
                    "const": "EC"
                  }
                }
              },
              "then": {
                "required": [
                  "crv",
                  "x",
                  "y"
                ]
              }
            },
            {
              "if": {
                "required": [
                  "kty"
                ],
                "properties": {
                  "kty": {
                    "const": "RSA"
                  }
                }
              },
              "then": {
                "required": [
                  "n",
                  "e"
                ]
              }
            }
          ],
          "not": {
            "anyOf": [
              {
                "required": [
                  "d"
                ]
              },
              {
                "required": [
                  "p"
                ]
              },
              {
                "required": [
                  "q"
                ]
              },
              {
                "required": [
                  "dp"
                ]
              },
              {
                "required": [
                  "dq"
                ]
              },
              {
                "required": [
                  "qi"
                ]
              },
              {
                "required": [
                  "k"
                ]
              }
            ]
          },
          "$comment": "RFC 8747 defines cnf as a confirmation key: the public half, present so a verifier can bind the record to the key that signed it. A private member here publishes the signing key inside the signed, self-authenticating, typically anchored record, and the only remedy afterwards is to revoke the identity. Mirrors _JWK_PRIVATE_PARAMS in the reference model, which already refuses these. A kty this schema does not name is not held to a key-material rule here: section 3.2.1 states signing algorithms per envelope context and fixes no set for the embedded-signature form of section 3.2.2, so an enum here would add a constraint the specification does not make, and such a key is refused later by the verifier. The n and e declarations are load-bearing rather than decorative: without them a non-string modulus reaches additionalProperties, which admits any canonicalizable value.",
          "additionalProperties": {
            "$ref": "#/$defs/canonicalizableValue"
          }
        }
      },
      "additionalProperties": false
    },
    "signature": {
      "type": "string",
      "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with only this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.",
      "pattern": "^[A-Za-z0-9_-]+$"
    }
  },
  "additionalProperties": false,
  "allOf": [
    {
      "$comment": "A record assembled from another party's evidence has no hardware root. Mirrors the cross-field check in the reference model, so a validator that only reads this schema enforces it too.",
      "if": {
        "required": [
          "origin"
        ],
        "properties": {
          "origin": {
            "required": [
              "kind"
            ],
            "properties": {
              "kind": {
                "enum": [
                  "third-party-control-plane",
                  "log-import"
                ]
              }
            }
          }
        }
      },
      "then": {
        "properties": {
          "runtime": {
            "properties": {
              "platform": {
                "const": "software-only"
              }
            }
          }
        }
      }
    }
  ]
}